Is CVE-2026-14209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14209 being exploited in the wild.

How severe is CVE-2026-14209?

Medium severity, with a CVSS score of 4.3, published 30 June 2026.

Which products and versions are affected?

Red Hat Red Hat Build of Keycloak; Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack; Keycloak Keycloak Admin UI extension.

Is there a fix for CVE-2026-14209?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14209 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14209?

Check whether you run Keycloak Admin UI extension or Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14209: Keycloak Admin UI auth bypass in brute-force-user endpoint

CVE-2026-14209 · Severity: medium · CVSS 4.3 · Published 2026-06-30

A security flaw was found in Keycloak's administrative interface, an open-source identity and access management solution. Under certain configurations, an administrator who is only supposed to search for users can bypass restrictions to view full user profiles, including sensitive personal information and security metadata. This could lead to unauthorized data exposure if a low-privileged administrator accesses details they are not permitted to see.

Technologies: Red Hat build of Keycloak. Vendors: Keycloak, Red Hat.

Quick answers

Is CVE-2026-14209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14209 being exploited in the wild.
How severe is CVE-2026-14209?: Medium severity, with a CVSS score of 4.3, published 30 June 2026.
Which products and versions are affected?: Red Hat Red Hat Build of Keycloak; Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack; Keycloak Keycloak Admin UI extension.
Is there a fix for CVE-2026-14209?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14209 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14209?: Check whether you run Keycloak Admin UI extension or Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability exists in the Keycloak Admin UI extension's 'brute-force-user' endpoint. When Fine-Grained Admin Permissions (FGAPv2) are enabled, the system fails to perform a 'view' permission check in the BruteForceUsersResource.java component when a search is performed using a specific user ID. An authenticated attacker with the 'query-users' client role can exploit this by accessing the GET /admin/realms/{realm}/ui-ext/brute-force-user?search=id:{userId} endpoint. This allows the attacker to retrieve full user representations, including PII and brute-force metadata, for users they are not authorized to view.

Affected products

Red Hat Red Hat Build of Keycloak
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Keycloak Keycloak Admin UI extension

Timeline

2026-06-30: disclosed
2026-06-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.